source3/winbindd/idmap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Tim Potter 2000
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   6    Copyright (C) Simo Sorce 2003-2007
   7    Copyright (C) Jeremy Allison 2006
   8    Copyright (C) Michael Adam 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "idmap.h"
  27 #include "lib/util_sid_passdb.h"
  28 #include "libcli/security/dom_sid.h"
  29 #include "passdb.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_IDMAP
  33
  34 static_decl_idmap;
  35
  36 /**
  37  * Pointer to the backend methods. Modules register themselves here via
  38  * smb_register_idmap.
  39  */
  40
  41 struct idmap_backend {
  42         const char *name;
  43         struct idmap_methods *methods;
  44         struct idmap_backend *prev, *next;
  45 };
  46 static struct idmap_backend *backends = NULL;
  47
  48 /**
  49  * Default idmap domain configured via "idmap backend".
  50  */
  51 static struct idmap_domain *default_idmap_domain;
  52
  53 /**
  54  * Passdb idmap domain, not configurable. winbind must always give passdb a
  55  * chance to map ids.
  56  */
  57 static struct idmap_domain *passdb_idmap_domain;
  58
  59 /**
  60  * List of specially configured idmap domains. This list is filled on demand
  61  * in the winbind idmap child when the parent winbind figures out via the
  62  * special range parameter or via the domain SID that a special "idmap config
  63  * domain" configuration is present.
  64  */
  65 static struct idmap_domain **idmap_domains = NULL;
  66 static int num_domains = 0;
  67
  68 static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
  69                                                     const char *domname);
  70 static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
  71                                               const char *domainname,
  72                                               const char *modulename,
  73                                               bool check_range);
  74
  75 struct lp_scan_idmap_domains_state {
  76         bool (*fn)(const char *domname, void *private_data);
  77         void *private_data;
  78 };
  79
  80 static bool lp_scan_idmap_found_domain(
  81         const char *string, regmatch_t matches[], void *private_data);
  82
  83 bool lp_scan_idmap_domains(bool (*fn)(const char *domname,
  84                                       void *private_data),
  85                            void *private_data)
  86 {
  87         struct lp_scan_idmap_domains_state state = {
  88                 .fn = fn, .private_data = private_data };
  89         int ret;
  90
  91         ret = lp_wi_scan_global_parametrics(
  92                 "idmapconfig\\(.*\\):backend", 2,
  93                 lp_scan_idmap_found_domain, &state);
  94         if (ret != 0) {
  95                 DBG_WARNING("wi_scan_global_parametrics returned %d\n", ret);
  96                 return false;
  97         }
  98
  99         return true;
 100 }
 101
 102 static bool lp_scan_idmap_found_domain(
 103         const char *string, regmatch_t matches[], void *private_data)
 104 {
 105         bool ok;
 106
 107         if (matches[1].rm_so == -1) {
 108                 DBG_WARNING("Found match, but no name??\n");
 109                 return false;
 110         }
 111         if (matches[1].rm_eo <= matches[1].rm_so) {
 112                 DBG_WARNING("Invalid match\n");
 113                 return false;
 114         }
 115
 116         {
 117                 struct lp_scan_idmap_domains_state *state = private_data;
 118                 regoff_t len = matches[1].rm_eo - matches[1].rm_so;
 119                 char domname[len+1];
 120
 121                 memcpy(domname, string + matches[1].rm_so, len);
 122                 domname[len] = '\0';
 123
 124                 DBG_DEBUG("Found idmap domain \"%s\"\n", domname);
 125
 126                 ok = state->fn(domname, state->private_data);
 127         }
 128
 129         return ok;
 130 }
 131
 132 static bool idmap_found_domain_backend(const char *domname,
 133                                        void *private_data);
 134
 135 static bool idmap_init(void)
 136 {
 137         static bool initialized;
 138         bool ok;
 139
 140         if (initialized) {
 141                 return true;
 142         }
 143
 144         DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
 145
 146         static_init_idmap;
 147
 148         initialized = true;
 149
 150         if (!pdb_is_responsible_for_everything_else()) {
 151                 default_idmap_domain = idmap_init_named_domain(NULL, "*");
 152                 if (default_idmap_domain == NULL) {
 153                         return false;
 154                 }
 155         }
 156
 157         passdb_idmap_domain = idmap_init_domain(
 158                 NULL, get_global_sam_name(), "passdb", false);
 159         if (passdb_idmap_domain == NULL) {
 160                 TALLOC_FREE(default_idmap_domain);
 161                 return false;
 162         }
 163
 164         idmap_domains = talloc_array(NULL, struct idmap_domain *, 0);
 165         if (idmap_domains == NULL) {
 166                 TALLOC_FREE(passdb_idmap_domain);
 167                 TALLOC_FREE(default_idmap_domain);
 168                 return false;
 169         }
 170
 171         ok = lp_scan_idmap_domains(idmap_found_domain_backend, NULL);
 172         if (!ok) {
 173                 DBG_WARNING("lp_scan_idmap_domains failed\n");
 174                 return false;
 175         }
 176
 177         return true;
 178 }
 179
 180 bool domain_has_idmap_config(const char *domname)
 181 {
 182         int i;
 183         char *config_option;
 184         const char *range = NULL;
 185         const char *backend = NULL;
 186         bool ok;
 187
 188         ok = idmap_init();
 189         if (!ok) {
 190                 return false;
 191         }
 192
 193         for (i=0; i<num_domains; i++) {
 194                 if (strequal(idmap_domains[i]->name, domname)) {
 195                         return true;
 196                 }
 197         }
 198
 199         /* fallback: also check loadparm */
 200
 201         config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
 202                                         domname);
 203         if (config_option == NULL) {
 204                 DEBUG(0, ("out of memory\n"));
 205                 return false;
 206         }
 207
 208         range = lp_parm_const_string(-1, config_option, "range", NULL);
 209         backend = lp_parm_const_string(-1, config_option, "backend", NULL);
 210         if (range != NULL && backend != NULL) {
 211                 DEBUG(5, ("idmap configuration specified for domain '%s'\n",
 212                         domname));
 213                 TALLOC_FREE(config_option);
 214                 return true;
 215         }
 216
 217         TALLOC_FREE(config_option);
 218         return false;
 219 }
 220
 221 static bool idmap_found_domain_backend(const char *domname,
 222                                        void *private_data)
 223 {
 224         struct idmap_domain *dom, **tmp;
 225
 226         DBG_DEBUG("Found idmap domain \"%s\"\n", domname);
 227
 228         if (strcmp(domname, "*") == 0) {
 229                 return false;
 230         }
 231
 232         dom = idmap_init_named_domain(idmap_domains, domname);
 233         if (dom == NULL) {
 234                 DBG_NOTICE("Could not init idmap domain %s\n", domname);
 235                 return false;
 236         }
 237
 238         tmp = talloc_realloc(idmap_domains, idmap_domains,
 239                              struct idmap_domain *, num_domains + 1);
 240         if (tmp == NULL) {
 241                 DBG_WARNING("talloc_realloc failed\n");
 242                 TALLOC_FREE(dom);
 243                 return false;
 244         }
 245         idmap_domains = tmp;
 246         idmap_domains[num_domains] = dom;
 247         num_domains += 1;
 248
 249         return false;
 250 }
 251
 252 static struct idmap_methods *get_methods(const char *name)
 253 {
 254         struct idmap_backend *b;
 255
 256         for (b = backends; b; b = b->next) {
 257                 if (strequal(b->name, name)) {
 258                         return b->methods;
 259                 }
 260         }
 261
 262         return NULL;
 263 }
 264
 265 bool idmap_is_offline(void)
 266 {
 267         return ( lp_winbind_offline_logon() &&
 268              get_global_winbindd_state_offline() );
 269 }
 270
 271 bool idmap_is_online(void)
 272 {
 273         return !idmap_is_offline();
 274 }
 275
 276 /**********************************************************************
 277  Allow a module to register itself as a method.
 278 **********************************************************************/
 279
 280 NTSTATUS smb_register_idmap(int version, const char *name,
 281                             struct idmap_methods *methods)
 282 {
 283         struct idmap_backend *entry;
 284
 285         if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
 286                 DEBUG(0, ("Failed to register idmap module.\n"
 287                           "The module was compiled against "
 288                           "SMB_IDMAP_INTERFACE_VERSION %d,\n"
 289                           "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
 290                           "Please recompile against the current version "
 291                           "of samba!\n",
 292                           version, SMB_IDMAP_INTERFACE_VERSION));
 293                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 294         }
 295
 296         if (!name || !name[0] || !methods) {
 297                 DEBUG(0,("Called with NULL pointer or empty name!\n"));
 298                 return NT_STATUS_INVALID_PARAMETER;
 299         }
 300
 301         for (entry = backends; entry != NULL; entry = entry->next) {
 302                 if (strequal(entry->name, name)) {
 303                         DEBUG(5,("Idmap module %s already registered!\n",
 304                                  name));
 305                         return NT_STATUS_OBJECT_NAME_COLLISION;
 306                 }
 307         }
 308
 309         entry = talloc(NULL, struct idmap_backend);
 310         if ( ! entry) {
 311                 DEBUG(0,("Out of memory!\n"));
 312                 TALLOC_FREE(entry);
 313                 return NT_STATUS_NO_MEMORY;
 314         }
 315         entry->name = talloc_strdup(entry, name);
 316         if ( ! entry->name) {
 317                 DEBUG(0,("Out of memory!\n"));
 318                 TALLOC_FREE(entry);
 319                 return NT_STATUS_NO_MEMORY;
 320         }
 321         entry->methods = methods;
 322
 323         DLIST_ADD(backends, entry);
 324         DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
 325         return NT_STATUS_OK;
 326 }
 327
 328 /**
 329  * Initialize a domain structure
 330  * @param[in] mem_ctx           memory context for the result
 331  * @param[in] domainname        which domain is this for
 332  * @param[in] modulename        which backend module
 333  * @param[in] check_range       whether range checking should be done
 334  * @result The initialized structure
 335  */
 336 static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
 337                                               const char *domainname,
 338                                               const char *modulename,
 339                                               bool check_range)
 340 {
 341         struct idmap_domain *result;
 342         NTSTATUS status;
 343         char *config_option = NULL;
 344         const char *range;
 345         unsigned low_id = 0;
 346         unsigned high_id = 0;
 347
 348         result = talloc_zero(mem_ctx, struct idmap_domain);
 349         if (result == NULL) {
 350                 DEBUG(0, ("talloc failed\n"));
 351                 return NULL;
 352         }
 353
 354         result->name = talloc_strdup(result, domainname);
 355         if (result->name == NULL) {
 356                 DEBUG(0, ("talloc failed\n"));
 357                 goto fail;
 358         }
 359
 360         /*
 361          * Check whether the requested backend module exists and
 362          * load the methods.
 363          */
 364
 365         result->methods = get_methods(modulename);
 366         if (result->methods == NULL) {
 367                 DEBUG(3, ("idmap backend %s not found\n", modulename));
 368
 369                 status = smb_probe_module("idmap", modulename);
 370                 if (!NT_STATUS_IS_OK(status)) {
 371                         DEBUG(3, ("Could not probe idmap module %s\n",
 372                                   modulename));
 373                         goto fail;
 374                 }
 375
 376                 result->methods = get_methods(modulename);
 377         }
 378         if (result->methods == NULL) {
 379                 DEBUG(1, ("idmap backend %s not found\n", modulename));
 380                 goto fail;
 381         }
 382
 383         /*
 384          * load ranges and read only information from the config
 385          */
 386
 387         config_option = talloc_asprintf(result, "idmap config %s",
 388                                         result->name);
 389         if (config_option == NULL) {
 390                 DEBUG(0, ("Out of memory!\n"));
 391                 goto fail;
 392         }
 393
 394         result->read_only = lp_parm_bool(-1, config_option, "read only", false);
 395         range = lp_parm_const_string(-1, config_option, "range", NULL);
 396
 397         talloc_free(config_option);
 398
 399         if (range == NULL) {
 400                 if (check_range) {
 401                         DEBUG(1, ("idmap range not specified for domain %s\n",
 402                                   result->name));
 403                         goto fail;
 404                 }
 405         } else if (sscanf(range, "%u - %u", &low_id, &high_id) != 2)
 406         {
 407                 DEBUG(1, ("invalid range '%s' specified for domain "
 408                           "'%s'\n", range, result->name));
 409                 if (check_range) {
 410                         goto fail;
 411                 }
 412         } else if (low_id > high_id) {
 413                 DEBUG(1, ("Error: invalid idmap range detected: %u - %u\n",
 414                           low_id, high_id));
 415                 if (check_range) {
 416                         goto fail;
 417                 }
 418         }
 419
 420         result->low_id = low_id;
 421         result->high_id = high_id;
 422
 423         status = result->methods->init(result);
 424         if (!NT_STATUS_IS_OK(status)) {
 425                 DEBUG(1, ("idmap initialization returned %s\n",
 426                           nt_errstr(status)));
 427                 goto fail;
 428         }
 429
 430         return result;
 431
 432 fail:
 433         TALLOC_FREE(result);
 434         return NULL;
 435 }
 436
 437 /**
 438  * Initialize a named domain structure
 439  * @param[in] mem_ctx           memory context for the result
 440  * @param[in] domname           the domain name
 441  * @result The default domain structure
 442  *
 443  * This routine looks at the "idmap config <domname>" parameters to figure out
 444  * the configuration.
 445  */
 446
 447 static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
 448                                                     const char *domname)
 449 {
 450         struct idmap_domain *result = NULL;
 451         char *config_option;
 452         const char *backend;
 453         bool ok;
 454
 455         ok = idmap_init();
 456         if (!ok) {
 457                 return NULL;
 458         }
 459
 460         config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
 461                                         domname);
 462         if (config_option == NULL) {
 463                 DEBUG(0, ("talloc failed\n"));
 464                 goto fail;
 465         }
 466
 467         backend = lp_parm_const_string(-1, config_option, "backend", NULL);
 468         if (backend == NULL) {
 469                 DEBUG(10, ("no idmap backend configured for domain '%s'\n",
 470                            domname));
 471                 goto fail;
 472         }
 473
 474         result = idmap_init_domain(mem_ctx, domname, backend, true);
 475         if (result == NULL) {
 476                 goto fail;
 477         }
 478
 479         TALLOC_FREE(config_option);
 480         return result;
 481
 482 fail:
 483         TALLOC_FREE(config_option);
 484         TALLOC_FREE(result);
 485         return NULL;
 486 }
 487
 488 /**
 489  * Find a domain struct according to a domain name
 490  * @param[in] domname           Domain name to get the config for
 491  * @result The default domain structure that fits
 492  *
 493  * This is the central routine in the winbindd-idmap child to pick the correct
 494  * domain for looking up IDs. If domname is NULL or empty, we use the default
 495  * domain. If it contains something, we try to use idmap_init_named_domain()
 496  * to fetch the correct backend.
 497  *
 498  * The choice about "domname" is being made by the winbind parent, look at the
 499  * "have_idmap_config" of "struct winbindd_domain" which is set in
 500  * add_trusted_domain.
 501  */
 502
 503 static struct idmap_domain *idmap_find_domain(const char *domname)
 504 {
 505         bool ok;
 506         int i;
 507
 508         DEBUG(10, ("idmap_find_domain called for domain '%s'\n",
 509                    domname?domname:"NULL"));
 510
 511         ok = idmap_init();
 512         if (!ok) {
 513                 return NULL;
 514         }
 515
 516         if ((domname == NULL) || (domname[0] == '\0')) {
 517                 return default_idmap_domain;
 518         }
 519
 520         for (i=0; i<num_domains; i++) {
 521                 if (strequal(idmap_domains[i]->name, domname)) {
 522                         return idmap_domains[i];
 523                 }
 524         }
 525
 526         return default_idmap_domain;
 527 }
 528
 529 struct idmap_domain *idmap_find_domain_with_sid(const char *domname,
 530                                                 const struct dom_sid *sid)
 531 {
 532         bool ok;
 533
 534         ok = idmap_init();
 535         if (!ok) {
 536                 return NULL;
 537         }
 538
 539         if (sid_check_is_for_passdb(sid)) {
 540                 return passdb_idmap_domain;
 541         }
 542
 543         return idmap_find_domain(domname);
 544 }
 545
 546 void idmap_close(void)
 547 {
 548         TALLOC_FREE(default_idmap_domain);
 549         TALLOC_FREE(passdb_idmap_domain);
 550         TALLOC_FREE(idmap_domains);
 551         num_domains = 0;
 552 }
 553
 554 /**************************************************************************
 555  idmap allocator interface functions
 556 **************************************************************************/
 557
 558 static NTSTATUS idmap_allocate_unixid(struct unixid *id)
 559 {
 560         struct idmap_domain *dom;
 561         NTSTATUS ret;
 562
 563         dom = idmap_find_domain(NULL);
 564
 565         if (dom == NULL) {
 566                 return NT_STATUS_UNSUCCESSFUL;
 567         }
 568
 569         if (dom->methods->allocate_id == NULL) {
 570                 return NT_STATUS_NOT_IMPLEMENTED;
 571         }
 572
 573         ret = dom->methods->allocate_id(dom, id);
 574
 575         return ret;
 576 }
 577
 578
 579 NTSTATUS idmap_allocate_uid(struct unixid *id)
 580 {
 581         id->type = ID_TYPE_UID;
 582         return idmap_allocate_unixid(id);
 583 }
 584
 585 NTSTATUS idmap_allocate_gid(struct unixid *id)
 586 {
 587         id->type = ID_TYPE_GID;
 588         return idmap_allocate_unixid(id);
 589 }
 590
 591 NTSTATUS idmap_backend_unixids_to_sids(struct id_map **maps,
 592                                        const char *domain_name)
 593 {
 594         struct idmap_domain *dom = NULL;
 595         NTSTATUS status;
 596         bool ok;
 597
 598         ok = idmap_init();
 599         if (!ok) {
 600                 return NT_STATUS_NONE_MAPPED;
 601         }
 602
 603         if (strequal(domain_name, get_global_sam_name())) {
 604                 dom = passdb_idmap_domain;
 605         }
 606         if (dom == NULL) {
 607                 dom = idmap_find_domain(domain_name);
 608         }
 609         if (dom == NULL) {
 610                 return NT_STATUS_NONE_MAPPED;
 611         }
 612
 613         status = dom->methods->unixids_to_sids(dom, maps);
 614
 615         DBG_DEBUG("unixid_to_sids for domain %s returned %s\n",
 616                   domain_name, nt_errstr(status));
 617
 618         return status;
 619 }